Reject malformed escaped Unicode before browser admission #313

🤖 Generated by the Agentic Engineer

Part of #283.

Strict streamed UTF-8 parsing still permits ASCII JSON escapes containing unpaired UTF-16 surrogates. Display and export then replace those values silently, violating lossless public-metadata admission.

For publishers, operators and product consumers, the expected result is consistent validation and honest public metadata. The hypothesis is that enforcing the existing boundary at its real caller prevents this failure without adding steps to the valid workflow.

Acceptance criteria:

• Reject malformed escaped Unicode keys and values across registry and dependency responses before admission; retain valid surrogate pairs and deliberate replacement characters. Exercise real browser display/export and partial-page behavior.
• Prove the regression fails on current main and passes with the smallest root-cause repair.
• Keep affected documentation consistent and deliver through reviewed, passing CI and an actual merge.

Success signal: the focused regression and valid-path controls pass within this delivery round. Size: small to medium.